MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bec1813fd645f0c1dd84ddf277999b79f1c07a94e6574a345d70184d8bfbc47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bec1813fd645f0c1dd84ddf277999b79f1c07a94e6574a345d70184d8bfbc47
SHA3-384 hash: ce26e08aa5e2359ff612c534c0c6c15cb0a4cfb3161527cb64d749ea792452a737f9e945d566cd3004c6599fded6f1b7
SHA1 hash: 90e0551b0c063f40f7bd2b928665baca4c3dfa05
MD5 hash: 2b0eb2dffd9788bfb9390e060f5e4bcc
humanhash: chicken-coffee-speaker-minnesota
File name:2b0eb2dffd9788bfb9390e060f5e4bcc
Download: download sample
Signature AgentTesla
Create hunting rule
File size:626'176 bytes
First seen:2021-09-17 18:53:02 UTC
Last seen:2021-09-17 19:01:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:VeYxaM8KuQlAvTkmsIJds1oigfXnqq/Sq:ujQINsIJdW+l
Threatray 9'967 similar samples on MalwareBazaar
TLSH T13AD4BF30179570D5E3727AB08BB3E042F5996D32AF9D92D83843F64DC2B3642E973A25
dhash icon d4c498f8f8b8ccd4 (6 x AgentTesla, 5 x SnakeKeylogger, 3 x Formbook)
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PAYMENT_SWIFT.xlsx
Verdict:
Malicious activity
Analysis date:
2021-09-17 18:08:37 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/d56f33fd-5ad6-4908-984d-ed23dae38fe8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/188800/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1031-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61752f319a5a1e91c5d20810/reports/5107edce-1415-42fe-ab17-a84d294cf450/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a3f421ae-5ad1-47e6-8194-792b6e4bd950
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/853031
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 485460 Sample: eu4BHvkV5L Startdate: 17/09/2021 Architecture: WINDOWS Score: 100 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected AgentTesla 2->41 43 Yara detected AntiVM3 2->43 45 4 other signatures 2->45 6 eu4BHvkV5L.exe 3 2->6         started        10 nwlrFL.exe 3 2->10         started        12 nwlrFL.exe 2 2->12         started        process3 file4 23 C:\Users\user\AppData\...\eu4BHvkV5L.exe.log, ASCII 6->23 dropped 47 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->47 49 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->49 51 Injects a PE file into a foreign processes 6->51 14 eu4BHvkV5L.exe 2 5 6->14         started        53 Multi AV Scanner detection for dropped file 10->53 55 Machine Learning detection for dropped file 10->55 19 nwlrFL.exe 2 10->19         started        21 nwlrFL.exe 2 12->21         started        signatures5 process6 dnsIp7 29 us2.smtp.mailhostbox.com 208.91.198.143, 49779, 587 PUBLIC-DOMAIN-REGISTRYUS United States 14->29 25 C:\Users\user\AppData\Roaming\...\nwlrFL.exe, PE32 14->25 dropped 27 C:\Users\user\...\nwlrFL.exe:Zone.Identifier, ASCII 14->27 dropped 31 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->31 33 Tries to steal Mail credentials (via file access) 14->33 35 Tries to harvest and steal ftp login credentials 14->35 37 2 other signatures 14->37 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0bec1813fd645f0c1dd84ddf277999b79f1c07a94e6574a345d70184d8bfbc47/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-17 18:53:16 UTC
AV detection:
15 of 27 (55.56%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bpwbqe75mrpqyhoyjxpso6mzw6pryb5jjzsxji2f24ayjwf7xrdq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
13675c7709efcd13c8334d547539a2c1c7f2e78e3cf9dee498c236d869493378
AgentTesla
31b7df14c156db3291584805bdf846c7440541b9c971a15f0706b8da59e618b5
AgentTesla
5d341e97346284948f292b2acef3b6a2b48f2e1b106732aeac5046723d5ec39e
AgentTesla
91f9f63b9d355ddcef27f8fd431029f4cb55cf8700f5257b0d20f6ae4c77baf9
AgentTesla
9efe8cef3127a10a3c0ee380a77298650e7a54e9e785d86f9871c00c2ad62bdf
AgentTesla
9f5246d9c9dc30f30f1ad1ffaa3e3a5e4b81f51d2b9059527190cd3a55523eb1
AgentTesla
a0280d342cc57efcb2b0a35cd901689ef9a71d446b9741791bb0ce19e1843ac7
AgentTesla
a79cd2afe6fbd88f394601ec42877ca66fb58a0844c3838abd1e2063fe7b07ab
AgentTesla
fdde861930d90cd01ecd816cbd4c0167757ea3068b4a67edd28b7b9514fdc1a2
AgentTesla
+ 9'957 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210917-xjmnasgbf6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
ad4a7895d529d5164302bb88596964ab42ff125bf0f5544418c80b6d438cb587
MD5 hash:
43ababb6b0a02907aad43084f12b10d9
SHA1 hash:
b60ba705891d5a666d64300181b475a46714ffa8
Link:
https://www.unpac.me/results/489b034d-8270-46d8-a0cd-e3d1dba221d5/
SH256 hash:
33b1b4144d7a3ee61f58604568205a169c7d9a8b38e9ca6713bdf1fd572d7658
MD5 hash:
1d186d752b05e2bc90314500f1633509
SHA1 hash:
b42cc59dddd1f5b547c9473730f3017b238f554b
Link:
https://www.unpac.me/results/489b034d-8270-46d8-a0cd-e3d1dba221d5/
SH256 hash:
0d9751dc11f0a0aee74ced99af3b221ed9191e680a5502890fc854ea4d17776e
MD5 hash:
8a7796fb1f2fc7ebac041b0667b121c1
SHA1 hash:
0fa3e0330b0de1f92904adbf86c3f27c0a154c70
Link:
https://www.unpac.me/results/489b034d-8270-46d8-a0cd-e3d1dba221d5/
SH256 hash:
0bec1813fd645f0c1dd84ddf277999b79f1c07a94e6574a345d70184d8bfbc47
MD5 hash:
2b0eb2dffd9788bfb9390e060f5e4bcc
SHA1 hash:
90e0551b0c063f40f7bd2b928665baca4c3dfa05
Link:
https://www.unpac.me/results/489b034d-8270-46d8-a0cd-e3d1dba221d5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0bec1813fd645f0c1dd84ddf277999b79f1c07a94e6574a345d70184d8bfbc47

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 0bec1813fd645f0c1dd84ddf277999b79f1c07a94e6574a345d70184d8bfbc47

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1628315/
Cape
Cape
https://www.capesandbox.com/analysis/188800/

Comments


Avatar
zbet commented on 2021-09-17 18:53:03 UTC

url : hxxp://192.227.158.110/im/kok.exe